promote the windows jobs and add the contributor trust gate (#3004) * pa-tui: session_ui.rs split 10/14 - the bash concern moves out of src/session_ui.rs (#2928) 481b2f28553cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * skills/prime-intellect: sync vendored sandbox docs to the VM-only surface (TS #2456 doc half) (#2751) a4e997e2e803merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): remove the duplicated restore_dock_focus initializer the #2751 squash double-applied The #2751 squash (1a9fd16b9) landed the heal rider line onto a tip that already carried the identical line from #2925 (e6e7a26e4) - the squash applied the stale pre-fold diff, duplicating the field (E0062). This restores the fixture to the parent 84dbb51e0 state (exactly one field). The label rider and the docs in the same squash are intended and stay. * pa-daemon: agent_engine.rs split 7/11 - the SessionEngine trait impl moves out whole (#2926) 2b07a22bd1d3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core + runtime: the harness-digest family - IDF-ranked digest/search, state-fingerprint staleness, newest-only digest contexts, validated kernel harness writes (TS #2392/#2400/#2394/#2463 parity) (#2750) bff9fa6ff122merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the kitty handoff e2e fixture initializes restore_dock_focus (#2927) 962ff3097575merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 7/14 - the settings concern moves out of src/session_ui.rs (#2930) fd71eaf2dfeamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 6/14 - the model-picker concern moves out of src/session_ui.rs (#2929) 2038abcf5754merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon/pa-cli: ACP model and effort pickers - configOptions at session/new, session/set_config_option, config_option_update (TS #2455) (#2758) fd977cb13ee6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): consolidate auth-lock reads - 36 lock cycles per first turn to 2, settings mutex closes the unmasked stall class (#2932) * perf(pa-core): consolidate auth-document reads through a validated cache * perf(pa-core): serialize same-process settings-lock holders (the #2915 pattern) The auth read-through cache on this lane unmasks a pre-existing stall: two worker threads racing the same settings.json pay the full TS 10x20ms retry sleep against each other (strace-verified: mkdir attempts 11us apart, the loser clock_nanosleeps the full 20ms; the paired census shows same-process overlapping settings acquisitions 2 on the base and 5 with the auth cache, sleep20 1 vs 2, and the timing legs pay a ~20ms-class stall on 3/6 fresh turns vs 0/6 base). The auth-lock cycles 150-300us same-process serialization was pacing the threads apart by accident; that masking is not a mechanism to keep. TS runs its synchronous settings lock single-threaded, so same-process settings contention is a Rust-port artifact, the exact class #2915 ruled on for the auth lock: a process-local mutex keyed by the document path serializes same-process callers for the microseconds the small read/modify/write holds. The file protocol, staleness judgment, and retry semantics are untouched: a foreign holder (another process) still surfaces WouldBlock and still takes the 10x20ms retry. The mutex is a leaf (the locked section performs only the document's own filesystem operations plus the caller's update callback; no settings callback re-enters with_lock - every callback is a pure JSON transform), and poisoning is recovered because the file protocol is the correctness mechanism. --------- Co-authored-by: perf-auth-lock-fast * perf(pa-daemon): zero-copy worker response path - routed msgs -17%, attach -22%, worker RSS -20% (#2935) * perf(pa-daemon): zero-copy worker response handoff - serialize the line from the borrowed trees, write the frame without re-buffering the payload * fmt(pa-types): the segments test write_frame call in the form CI rustfmt wants * fmt(pa-daemon): the response-path call forms CI rustfmt wants (VM cargo fmt at the exact head) * fix(pa-daemon): restore the response_line TS-key-order test the new-test insert orphaned (clippy empty_line_after_doc_comments was the symptom) * fmt(pa-daemon): the restored test doc comment indent * fmt(pa-daemon): single trailing newline at file end --------- Co-authored-by: wc * pa-daemon: agent_engine.rs split 6/11 - the Turn types move out of src/agent_engine.rs (#2931) b2ca4deea5afmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): batch the queue-checkpoint journal pair - 4 syncs per warm turn to 2, crash window strictly narrowed (#2936) * perf(pa-daemon): batch the queue-checkpoint journal pair into one durable append The queue checkpoint (prompt/steer/follow-up admission, turn settle, queue mutations) appends two records to the worker recovery journal - the queue snapshot and the busy/operation verdict - as two separate open+write+fsync cycles, paying two journal flushes per checkpoint. Both records describe one atomic checkpoint, and the busy verdict must never publish over a snapshot that did not persist, so the pair can ride ONE open+write+fsync: the batch is all-or-nothing durable, the on-disk line order matches the sequential form exactly (snapshot first, then the verdict), and an unchanged verdict keeps appending the snapshot alone. Measured on the warm-turn admission path (the wave-5 warm-durable-append decomposition): the two journal fsyncs sit inside the TUI-ack-to-user-row phase together with the session append's fdatasync; batching removes one of the three durable syncs per warm turn without weakening any durability guarantee (the session append's per-row fdatasync is untouched). * test: rustfmt the batched-checkpoint test call sites (gate fmt finding) * fix(pa-tui): the exit watchdog holds fire while the flush drains - healthy slow drains no longer truncate scrollback, TS-convergent (#2937) * perf(pa-tui): the exit guard holds its force-quit while the exit path drains - slow terminals keep the whole scrollback flush On a terminal that consumes the exit flush slowly (a laggy ssh at ~0.5-2MB/s), the flush of a large transcript outlasts the 1500ms FORCE_QUIT_AFTER_MS deadline that arms at the second Ctrl+C, and the watchdog fires mid-flush: strace shows its restore writes winning the pty FIFO race at a flush-chunk boundary, exit_group(0) landing while the writer still holds ~64-82% of the transcript (40k rows: 8.74MB flush truncated to 1.5-3.1MB), 'shutdown stalled; forced exit.' printing on a healthy drain, and the restore bytes queueing mid-stream behind the flushed rows. TS has no watchdog at all (its handleCtrlC second press runs the async shutdown, and slow writes simply wait), so both the message and the truncation are port-only. The guard becomes drain-aware: the flush writer reports progress per completed 32KiB chunk (view.rs FlushSink), the release tail and the resume hint report theirs, and the watchdog holds its fire while progress landed within EXIT_PROGRESS_GRACE_MS (500ms) - the hard 1500ms ceiling stays for the silent case (the wedged loop the guard was built for). Flush chunks shrink 256KiB -> 32KiB so a drain of at least ~65KB/s completes chunks inside the grace window; the flush byte stream is unchanged (the exit-flush lane's byte-identity oracle). The truncated scrollback contract is restored on slow drains: the flush completes byte-identically, the release tail lands after the last row, and the message prints only for a genuinely stalled drain. The exit-guard unit tests grow the hold/fire decision table; a new real-pty e2e (pa-cli slow_drain_exit_guard_e2e, the kitty-release harness pattern) drives the real chat surface over a paced pty master and asserts both sides: a draining terminal flushes the whole transcript with no forced exit, and a stalled drain still fires. Rider (disclosed): kitty_release_handoff_e2e grows the restore_dock_focus field the #2916 squash dropped from its fold-time heal - the tip's pa-cli test target does not compile without it. * test(pa-cli): the slow-drain e2e asserts the forced fire structurally The re-executed test binary's libtest harness captures stderr per test, so the watchdog's 'shutdown stalled' line never reaches the pty in the harness child (the real binary writes it to fd 2 - the lane's VM bench legs assert it there). The stalled-drain leg instead asserts the forced exit structurally: the forced restore's own alt-screen leave lands on top of the exit path's (a clean exit leaves it exactly once), the flush never reaches the transcript tail (one copy of the last user row, the startup viewport's), and the process dies with the guard's exit code inside the stall window. Harness needles use the user-message rows (assistant rows carry per-word SGR spans) and the post-exit drain reads the pty's kernel-held bytes before asserting. * fmt: the slow-drain e2e needles and the watchdog's progress read * clippy: doc backticks + checked Duration subtraction in the guard tests; the e2e's needle check takes the direct is_none --------- Co-authored-by: perf-slowdrain-exitguard-fast * perf(pa-core): consolidate settings-lock reads - 32 lock cycles per first turn to 2 (#2941) * pa-ai/pa-core/pa-cli/pa-tui: grok-4.7 on every serving surface (TS #2505) + Claude Code 2.1.281 + Anthropic subscription ban-risk warning (TS #2645) + one owner for the Prime team header, retry failed !command credentials (TS #2497) (#2755) 7373eb471670merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-cli): the interactive_daemon_e2e wedge root-kill - PDEATHSIG + orphan sweep + the 300s headless wall (#2942) dbed1170fa2bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli/pa-daemon: session opens wait through a daemon update restart (TS #2391) + the failed-restart hint (TS #2515) (#2763) e7a84e749089merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): the all-idle compaction fires like TS and rides the TS compact sync class - journals bounded (#2944) * perf(pa-daemon): settle-tail compact consolidation - the all-idle compaction fires like TS and rides the TS compact sync class The worker recovery journal's all-idle gate ran BEFORE the record insert, so a single-session journal's own busy admission record blocked every settle's compaction: the compact never fired on the dominant shape and the journal grew append-only for the session's lifetime (TS computes the gate POST-insert and compacts at every changed-idle record). The gate now matches TS, bounding the file. Where the compact fires, its temp sync_all was a sync class TS's compact does not pay (TS worker-recovery-journal: writeFileSync + renameSync, no fsync; the command journal's writeFileAtomicSync counterpart does carry fsync). The Finalize seam now encodes the sync class per owner: RetryBusy keeps its fsync (command journal), Synced keeps the Rust-native terminal-compaction journal's belt, and Bare is the TS worker shape - temp write + rename, no fsync. Durability is owned by the append path (the fresh-write class is untouched): the compacted form holds only records the append path already made durable, so a lost compact falls back to the append-only history, which replays identically. * test-only rustfmt of the new test call site (the gate's one fmt finding) * runtime/kernel: vendored-runtime hardening + kernel stderr owner-only (TS #2372/#2423/#2500/#2471/#2478/#2425 parity) (#2744) ea5abd1bbe1bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 11/14 - the prompt submit pipeline moves out of src/session_ui.rs (#2943) 3bafbc007b74merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): 8-byte packed span records with per-pack style table - scroll retention -7.5MB, byte-identical output (#2939) * perf(pa-tui): denser packed span records - style table + derived offsets (8B/span), byte-exact range expansion * test(pa-tui): rustfmt the exhaustive row-pack range oracle * fix(pa-tui): clippy - if-let style dedup + drop redundant test clones * pa-tui: fix the submit-outlived-by-switch idle-gate race - the turn-end watermark restarts with the mounted stream (#2945) c661290b1b77merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: hold spawn-name reservations until admission is durable; collect returns cancelled envelopes for just-deleted targets (TS #2396 + #2388 F4) (#2757) 18aa772bd3b2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/pa-core/pa-daemon: codex stale-chain retry after metadata (TS #2374) + safety failures permanent (TS #2472) + quota park until reset with auto-resume (TS #2375) (#2761) dc9892ffbc1emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-tui): the headless settle bound names its stuck member in 60s - defense-in-depth inside the wedge wall (#2949) The interactive_daemon_e2e exit-gate wedge family is root-killed upstream (#2945: the turn-end watermark restarts with the mounted stream) and the harness carries the 300s wall (#2942). This closes the remaining gap: the headless settle was the run loop's only unbounded wait on the product side — a settle member that never drains parked the run forever with no failure name (TS exits the process at shutdown and lets in-flight work dangle, so the settle has no TS counterpart). The gate's twelve settle members are now snapshotted (HeadlessSettle: settled() is the old gate exactly; blockers() names them), and after the plan completes a stuck member fails the run within HEADLESS_SETTLE_TIMEOUT_MS (60s) with the member named — e.g. 'a turn still active' — instead of waiting out the harness's 300s wall with a generic timeout. Green settles are milliseconds after HeadlessDone (the suite's green wall is ~15s; the last submit's own ack bound is 10s), and terminal runs never arm the bound (HeadlessDone exists only on the headless harness; a live terminal ends the run on exit_requested + the exit guard). Proven end-to-end by the lane's matrix: the wedge converted to a 98.4s attributable red naming the latched member (the bound-only diagnostic arm), and the full candidate stayed clean at 30/30 interleaved trials vs 3/30 wedges at the lane parent (record 20260927-085200-interaction-exit-gate-hang-remediation, bench hillclimb). * perf(pa-daemon/rpc): warm the model registry at RPC session boot - first get_available_models 1170.6ms to 58.9ms (#2953) TS session boot resolves the initial model through refreshAvailableModels (model-resolver.ts), which also fetches the live Prime Inference catalog in the background and caches it on disk; the daemon worker fires the same fire-and-forget refresh from its create path (worker/create.rs). The RPC mode hosts the session in-process with no create command, so nothing warmed the caches: an integration's FIRST get_available_models call paid the whole awaited refresh chain on its response path (measured 812-1296ms on the bench VM; the 15s fetch-timeout worst case on a degraded network) while the same command on the daemon and ACP surfaces answers from the validated snapshot. Mirror the daemon worker boot spawn: the caches warm during the session's first turn, and the first call serves the same snapshot. Write behavior is unchanged: the same cache files, the same write-on-fetch-success conditions, the same cadence (hour-gated catalog refresh, 5-min private-authorization TTL), only started at boot. Co-authored-by: perf-rpc-models-persist * pa-tui: session_ui.rs split 4/14 - the share concern moves out of src/session_ui.rs (#2922) b0d72b29a700merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 8/11 - the turn-execution impl moves out (#2934) a59d3389dfbamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 5/8 - the worker-lifecycle concern moves out of src/supervisor.rs (#2956) 205f4d0f469cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 8/14 - the sessions concern moves out of src/session_ui.rs (#2957) 7d19e9832120merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 6/8 - the signals concern moves out (#2960) a6562bc252efmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 10/11 - the lifecycle concern moves out of src/agent_engine.rs (#2962) 17d3573c5a58merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 12/14 - the keys concern moves out of src/session_ui.rs (#2958) bc6b7d82cb0bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 11/11 - the facade trim: the last product free fns move out; the file ends as the composition root (#2964) 1fe6a6791030merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 8/8 - the facade trim: the notes concern moves out, the test battery re-homes (#2963) 8a5274baa0d9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 9/14 - the panels concern moves out of src/session_ui.rs (#2961) 377eda9ded15merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 13/14 - the apply concern moves out of src/session_ui.rs (#2965) c10a44e407cdmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: cap kernel host-request cell source at 2 KiB (the TS #2475 port) (#2966) 96f689fc38femerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the /model picker resolves by provider, never the first same-id catalog entry (fixes the operator report) (#2967) 24411964739emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 14/14 - the facade trim: the file ends as the composition root (#2968) 60cbb4fbb642merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): the oauth refresh leaves the auth lock - fetch under single-flight, hold-sum 396ms to 0.09ms (#2971) An expired stored OAuth credential refreshes its token inside AuthStorageBackend::with_lock: the OAuthIntegration seam is synchronous by contract, so the network round trip runs under the document lock AND under the process mutex that spans the whole critical section, stalling every other same-process auth read and write for the fetch (the RPC cycle_model path measured 194-201ms auth.json.lock holds per switch on the bench VM; the assembly read pays one ~0.2ms cycle, the switch pays the fetch). The TS product holds its own lock across the same await (refreshOAuthTokenWithLock -> withLockAsync), but its single-threaded runtime never blocks other work on it; this engine is threaded, so the port narrows the lock scope instead: load-then-lock. The document loads through the consolidated read arm, the token fetch runs outside every lock behind a per-provider single-flight gate (the in-process serialization TS gets from its single-threaded runtime, with the expiry re-checked under the gate so a second caller never spends a single-use refresh token after the first flight landed), and the write re-enters the same locked read-modify-write protocol - now held only for the re-read, insert, and atomic write, and skipping the write entirely when a peer refreshed while the fetch ran. File protocol, read results, and every resolution outcome are unchanged. * pa-daemon: the supervisor roster broadcasts only on content change (the TS #2481 port P3) (#2974) 054553b8ca12merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli/pa-tui: prime-agent update - the TS->Rust migration path (uninstall TS, install Rust, sessions preserved) (#2981) 739ed7f7d015merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core/pa-daemon): a settled RLM child releases its kernel at the settle park - ~27MB reclaimed per settled child, TS #2483 port (#2983) * perf(pa-core/pa-daemon): a settled RLM child releases its kernel at settle - snapshot-flushing stop_kernel, revivable (TS #2483) The rust port of the stale perf PR #2483's inline arm (the supersession analysis: the not-superseded claim - settled children hold a worker and a kernel until parent close; nothing at the tip releases them; the daemon-mode whole-worker passivation stays deferred to the orchestrator): - IpythonKernelProvisioner::stop_kernel (TS stopKernel): shuts the owned kernel down with a final namespace snapshot WITHOUT marking the provisioner disposed; a kernel still starting up is joined first and shut down the same way (the TS managerPromise arm). The stop records a pending-stop gate (TS pendingStop) that the next start_kernel_impl awaits before reading the snapshot back, so a follow-up turn's fresh boot revives the flushed namespace instead of racing the flush; a completed stop awaits instantly and each stop supersedes the previous (a clonable watch receiver: multiple revival waiters gate on it). - The session engine gains stop_kernel_snapshot (the TS stopKernel({snapshot:true}) seam beside dispose_kernel), and the SessionEngine trait gains release_settled_child_kernel (default no-op): the AgentSessionEngine arm evaluates the canPassivateSettledSession gates engine-side - no unsettled descendants (has_unsettled_rlm_work), no registered cron/heartbeat jobs (a worker-wired probe over the shared cron store) - then fires the per-build release probe (a weak provisioner reference, the background-bash-probe adoption pattern, cleared on retire/close). - The turn runner's park arm fires it best-effort when the worker core proves the parent-owned, unattached, unqueued idle state (rlm_depth>0, no attached clients, not compacting, no lane work - the park arm's own construction). The divergence the port discloses: rust children are worker processes (the parent has no in-process reach and the wire is frozen), so the release triggers at the child's own idle park instead of the TS parent's run-settle hook - the same revivability semantics (the next kernel use boots fresh from the flushed snapshot), and the roster/collect surfaces are untouched by design. Tests: the provisioner stop flushes the snapshot and the next ensure revives the namespace (live-kernel, ambient-venv-gated); the park arm's policy matrix (a parent-owned child releases, a root/attached/compacting session stays resident); the engine gates (a registered-jobs probe defers the release, the probe fires otherwise). * test(pa-daemon): the park-arm release test waits on observable readiness (the review advisories) Two BUGBOT test advisories on the first review: the park-arm test's bounded poll used fixed sleeps (a retry-to-green readiness wrapper). The recording engine now notifies on every release fire, so the test waits for the observable readiness - the notification is the pass condition, the bounded timeout is only the failure bound for the positive arm and the absence bound for the gated arms (no fixed sleep ever makes a pass). The commit also lands the VM's cargo fmt output on the touched files (the first commit's hand-written formatting failed the review's fmt pre-flight: the lane builds on the VM only, and the formatted sources must sync back before every commit). * perf(pa-core): provider auth answers once per provider - the #2479 memoization ports, per-model probe -66% (#2973) * perf(pa-core): provider auth answers once per provider and the private PI authorization cache parses once per file identity (TS #2479) The rust port of the four unclaimed mechanisms of the stale perf PR #2479 (the supersession analysis: the rest of that PR's premise landed via #2932's storage read-cache): - get_available's per-model has_configured_auth becomes a per-provider memo: the catalog walks hundreds of models over a few dozen providers and each probe rebuilds the provider's auth-source candidates, while a same-registry probe is stable by construction (&self, no mutation between models). TS getAvailable's authByProvider map. - get_rlm_searchable_models' per-model get_auth_status becomes the same per-provider memo (TS _authenticatedRlmModels' selectableByProvider). - read_private_prime_authorization_cache serves from a process-wide stat-identity snapshot (dev/ino/mtime_ns/len, the TS CatalogFileIdentity) while the file is unchanged; the port builds a fresh registry per resolution touchpoint (the TS session kept one long-lived registry), so the parse would otherwise re-run on every resolution. Only a successful parse bracketed by one identity is pinned, a failed read unpins (retries), and the write path's atomic rename supersedes (new identity). - AuthStorage memoizes auth-source candidates keyed by the hashed material itself (TS authCandidateMemos): reuse skips only the SHA-256 work, env values are deliberately re-read on every call, command values resolve before the memo, and stale checks run against the memoized candidate (candidates are immutable). Tests: the per-provider status memo gates one stale provider across all its models while a second authed provider keeps its models; the private-cache snapshot pins stable parses, re-parses rewrites, and never pins a failed read or resurrects a deleted file; the candidate memos supersede exactly when the hashed material changes (a stale marking from an old value never gates a changed one). * test(pa-core): the stale-provider memo test asserts the tip's stale-aware has_auth The memo regression test claimed a stale-marked provider's models stay in get_available ("stale is only the searchable-set's gate") - but AuthStorage::has_auth is stale-aware at the tip (available_candidate skips candidates matching a marked stale token), so get_available gates the stale provider too, and the tip's get_rlm_searchable_models gates it twice over. The memo preserves exactly those semantics; assert them: the stale provider is gated across all its models from BOTH sets, and a second authed provider keeps its models. Discovered by the full-suite fleet gate (gate_1790546015_945232) - the lane's local legs had not run the test suite; the three other gate reds (kernel_restore_guards x2, tui_prime_login_escape) are SOLO-GREEN on the exact head content (co-scheduling class, the standing family from gate_1790531716). * test(pa-core): behavior-focused wording in the candidate-memo test comments (the review advisory) The BUGBOT history-narration advisory asked for comments that state the current behavior rather than the sequence of edits: the env-change arm now says what the memo key does (a changed value changes the key, so the rebuilt candidate's value fingerprint differs from the stale token's) and the return arm says the marked material's candidate re-serves when its value returns. * pa-cli/docs: the update fetch source flips to the official domain at the rust-to-main merge (#2984) 309dd96b1f96merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stages 1-2 - the test mass re-homes + the delete concern moves out (#2985) bd221cb5e70amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): saved_session_context reads windowed-first - worker resume CPU -140ms, the parse signature (#2969) * perf(pa-daemon): windowed-first saved_session_context - the create-path model restore reads the windowed store (restored_settings + has_thinking_level) instead of full-parsing the session history; open_windowed's full-open fallback keeps unsupported/malformed files identical; differential oracle keeps the pre-change full-parse reader as the reference across no-boundary/in-window/model-only-before/thinking-only-before/malformed-prefix fixture classes * perf(pa-daemon): address the Bugbot findings on the windowed saved_session_context - comments describe current behavior only, the oracle helper returns the owned TempDir so fixture scratch trees clean up at test scope end --------- Co-authored-by: perf-launch-open-fast * ci: unify workflows under .github/ + port the vouch gate The staged-copy era ends (operator-authorized workflow-scope push): .github/workflows/ is the one home for workflow files. - ci.yml: the staged windows-cross/windows/deny jobs promoted from ci/workflows/ci.yml as the windows job set (the deny job pinned to the live continuous.yml shape: cargo-deny --all-features --workspace check advisories licenses, the `make deny` mirror); ci/workflows/ deleted entirely (benchmark.yml goes with it - it needed self-hosted `prime-sandbox` runner labels no registered runner carries; the wave stays runnable via `make perf-wave`). - ci.yml + codebase-health.yml: the contributor-trust gate ported from main (mitchellh/vouch/action/check-user@v1, allow-fail): push events always allowed, PR authors must be bot/collaborator/vouched - every job keys on the trust output, so unvouched PRs never bill a minute. The vouched list resolves from the repo default branch's .github/VOUCHED.td (main) - nothing local on this branch. - contribution-gate.yml ported VERBATIM from main: unvouched PRs and issues auto-close (check-pr/check-issue) - the admin-spam killer. - CONTRIBUTING.md ported from main (vouched-contributor policy; the TS-repo-only sections adapted to this branch) + the PR template gains main's vouch line. - Makefile: actionlint lints all five live workflow files; activate-workflows removed (obsolete). Stale staging references in docs/ and the battery scripts made truthful. * pa-core: compact_session.rs split - the tests re-home + the summarization, anchor-selection, and boundary cuts (#2987) f43aebc9c50dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 3 - the render concern moves out (#2988) 03a6fcc07793merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the Rust port takes over the prime-agent keyword - clean TS daemon shutdown, config preserved (#2972) 737e52dc7695merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the scheduling catalog fans out per-worker (the TS port P4) (#2979) 1e78bb715fddmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 4 - the open + incident concerns move out (#2991) 0ef076a06131merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: session_store.rs split - the index, read, write, view, info, tests children (#2990) 7b58b0acb457merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 5 - the data + input concerns move out; the file ends as the composition root (#2992) cadb8b4f33d6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: the README becomes the Rust product's own; the port-process docs are removed (#2993) fe891d188ad0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: snapshot.rs split stages 1-2 - the test mass re-homes + the tool-fold concern moves out (#2995) eaa4b672f2f8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: snapshot.rs split stage 3 - the decoder concern moves out; the file ends as the composition root (#2996) 1564648986edmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: rlm_children.rs split - the composition root (host, lifecycle, usage, registry, tests) (#2997) 4ee722d403b6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: interactive.rs split - the tests, onboarding, headless, render, reconnect, run children (#2998) d592a0672d5dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): share the open's artifacts + skip the depth scan's full parse (cold-open-residual) (#2970) 5b75513ff7fbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: every session-exit route restores the terminal - the kitty-mode leak into the shell is fixed (#3001) 8f84a46233cdmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: the family-seeding e2e spawns pin the daemon's session dir (the flash e2e's seeded-family red) (#3003) c54ff2a09a84merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: undo the condensed activity runs - the collapse mode becomes details mode minus thinking blocks (#2999) a6d8414d818cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci+pa-types: the first real windows runs surface tip cfg-hygiene gaps - unix-gate the pa-types sites the cross-check flagged (the #2833 pattern, zero unix behavior change): terminal.rs unix imports + the non-linux OLCUC arm, memory_release trim param, process.rs the redundant unsafe on the safe winapi wrapper; drop dangling pointers to the tip-deleted port-process docs (windows-readiness.md/installer-ci-design.md) from ci.yml/continuous.yml * pa-cli: print_boundary.rs split - the 4 stages: events, compaction_arms, autorefine, tests (#2989) 2292af8f1cefmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: bash_view.rs split - under 1,000 lines (#3008) 15d9c1a659efmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: auth_panel.rs split - under 1,000 lines (#3009) 8c3061a5db29merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon+pa-core+pa-cli: the second windows-cross run pins the remaining cross-target lint surface - cfg-gate the unix-only reaping/signal/socket helpers their unix callers prove dead on the cross target, add the # Errors docs the windows stubs never carried, and fix the two doc/code-order nits (the #2833 pattern, zero unix behavior change) - pa-daemon: boot_reap gates the reaping census family (is_product_binary, is_worker_argv, supervisor_argv_names_socket, normalize_socket_spelling - its doc now states the darwin truth the gate keeps, all(unix, not(linux)) on the proc-environ stub, dead-code-allowed ReapKind::Supervisor whose one constructor is linux), rpc/mod.rs gates spawn_signal_handlers' call+fn and its SIGTERM/SIGHUP exit consts, signal_drain.rs gates the unix signal imports and recv_opt, socket.rs gates unlink_stale_socket and the LOCK_* lease consts + documents the windows no-op stub, accept_loop.rs gates the four unix socket-pair stand-in tests, signals_shutdown.rs gates begin_signal_drain (its only lib caller is the unix drain loop) + the two drain-state tests, supervisor.rs splits the unix-only PrepareState import, the venv/download/installer unix-test helpers and the supervisor/roster test imports carry their platform truth, session_store/info.rs marks the windows twin's unused identity param - pa-core: perms.rs/shell.rs give the cfg(windows)/cfg(not(unix)) stubs the # Errors sections their unix siblings have + backtick ProgramFiles/SystemRoot + hoist the windows gh-command consts above the statements, export_share.rs hoists CREATE_NO_WINDOW - pa-types: the windows is_process_alive stubs get their # Errors sections, STILL_ACTIVE backticks, swallow_sigint and the non-linux STDIN_TTY_PATH arm take their platform cfgs - pa-cli: the DaemonProbe probe-result enum waives large_enum_variant (the windows pipe client's transport state crosses the budget; the probe value is a rare one-shot) - pa-models: refresh_compat's snapshot metadata binds only its unix mode reader uses cargo clippy --locked --workspace --target x86_64-pc-windows-gnu --all-targets -- -D warnings: clean; native clippy -D warnings: clean; fmt: clean * pa-tui: heartbeats_picker.rs split - under 1,000 lines (#3011) 13849ce9138cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the queue groups internal prompts in the summary; the edit surface is user-origin only (#3012) b19ffd2ff84fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: docs/ ends empty per the operator's ruling; the README's install detail goes with it (#3007) d89e319660c4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the terminal-state differential - every armed mode restores on every exit route (#3002) aba71e8b491dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the worker test mass splits by family - under 1,000 lines (#3014) f011aaac54c7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-ai/pa-agent: /tier command + Default service tier settings row + footer badge + completions service_tier forwarding + proxy serviceTier (TS #2144 half + #2491 half) (#2735) e8cdef33d443merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core/pa-daemon/pa-types: the Windows platform gaps close - the tilde arm, the win32 path resolution, the TS launch budgets (#3016) 438012e04c27merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the agents_view test mass splits by family - under 1,000 lines (#3018) 7c488aca640bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-daemon): the compacting admission gate - a racing turn defers through the compaction window, the parked work delivers after it (#3021) b15dc777d141merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): cut the refine pre-LLM full-entries snapshot clone (-9.5ms / -30.4% pre-LLM at 10MiB) (#3013) f9c343f8d7a5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790621761_1065006 GREEN. * perf(tui): slice the kitty-probe reader-lock window to 10ms polls - early typing delivers while the probe listens (#3010) 07be8ffbcc74merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the installer bootstraps its own Python via uv; the output flow; the bash-3.2 parse fix; the test suite moves lane-side (#3017) a2c94944cc40merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): refine pushes its appended rows instead of rebuilding the context (-25.4ms / -35% at 10MiB; TS-parity restoring) (#3020) f3a9757dd30dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-core): the digest terms' window direction - TS slice(-4) keeps the NEWEST four texts, not truncate(4)'s oldest four (#3019) f310e1c9bc42merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-core): the compact digest-capture placement oracles - the ENTER capture is the TS-parity shield (byte-identity across placements in frozen windows; the racing class) (#3006) ae542c6a56bcmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core/pa-agent/pa-daemon/pa-tui: settings.imageModel routes image turns to a configured image model + the [python-skills-unavailable] notice (TS #2453 + #2381) (#2741) 5098db88b8f8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the TS daemon always stops on install - busy daemons get the forced shutdown (#3028) 78b0b58de028merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: per-call-site durability for the shared atomic_write - the TS WriteFileAtomicOptions shape (#3023) 2acae69edf1fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: the last docs/ file goes - the terminal-leak audit repo copy (the ruling final straggler) (#3026) 0d72ff3d77d0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): flush the RPC compaction_start frame before the pre-summarizer CPU span (client-visibility: +48.8ms p50 -> +0.143ms, 341x) (#3024) ddf75643ab00merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790634676_1065157 GREEN. * pa-tui: agents_view_forest.rs split - under 1,000 lines (#3040) 741be982e655merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * privacy: scrub personal machine paths and identity data from docs + fixtures (the security-scan lane) (#3046) ba9ea3b7eb5amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the subagent surfaces - one running count on the prompt bar, one dropdown in the agents view (#3031) b1ee386c0ddemerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: the windows runtime triage workflow - on-demand Windows battery runs on any ref (#3022) 425b1751cb67merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: manager.rs split - under 1,000 lines (#3039) 5220b3c2f589merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-cli is pedantic-clean (#3050) f2fdb439d3demerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-daemon is pedantic-clean (#3029) c233c84b62dcmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * skills: the parity quick-fixes (#3058) 4de8f9c2acc9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: info_commands.rs split - under 1,000 lines (#3057) febdcffc7cbbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: fold 3's auto-merge doubled the gated PrepareState import (both sides added #[cfg(unix)] use crate::update_prepare::PrepareState at different spots and git kept both) - keep the commented one, drop the bare twin (E0252) * pa-core: agent_traces.rs split - under 1,000 lines (#3061) 5518a73acaf0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: markdown.rs split - under 1,000 lines (#3066) f23b3d05c93dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: interactive_mode.rs split - under 1,000 lines (#3055) b559cd018f80merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the settings page pass - spacing, arrow value-cycling, the tab keys, the white selection, the fullscreen retirement, two regressions (#3051) 286006389509merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the folded signals_shutdown imports PrepareState from super ungated while the fold's parent keeps the re-export behind #[cfg(unix)] - E0432 on both windows targets; gate the import to its one unix use (the #2833 pattern, zero behavior change) * skills/runtime: the generic mcp skill + the discovery/tooling surface (#3063) 563c576e8123merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): the recurring capture-freshness memo - skip the redundant kernel re-dump while the namespace provably cannot have changed (#3037) 09043ae3b2b4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: telemetry.rs split - under 1,000 lines (#3074) 2aeda90ba25bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: model_picker/mod.rs split - under 1,000 lines (#3070) 867dfa067633merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: session_engine/mod.rs split - under 1,000 lines (#3062) fe1ee606180bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the compact_session test mass splits by family - under 1,000 lines (#3073) e27835fee7f4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: rlm_ledger.rs split - under 1,000 lines (#3078) 758ea09ebc34merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: auth/manager.rs split - under 1,000 lines (#3071) 36a261afd673merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: queued.rs split - under 1,000 lines (#3079) 91873baa42cbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the promoted windows-cross finally reaches the merged tip surface - the tip's own ci.yml never ran these jobs, so its signals_shutdown kept ClientRouting in the ungated import list (its only use sits in the unix begin_signal_drain arm) and the fold carried my #[cfg(unix)] gates onto the four accept-loop tests whose tip versions are portable duplex tests - gate the ClientRouting import, un-gate the four tests to the tip's shape (the #2833 pattern, zero behavior change) * pa-tui: ctrl+s stashes and restores the prompt draft (#3072) 443ab531022amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: venv.rs split - under 1,000 lines (#3077) d6ae9a7770e9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * comments: the CI-unification surfaces drop the migration-era staging narration - the ci.yml header, the Makefile perf-wave gate, and the two perf-wave script headers describe current behavior only (one home for workflows; the perf wave is command-line-only because a hosted run would need self-hosted prime-sandbox labels no registered runner carries); the historical record stays in the docs (bugbot 65dfc19a) * pa-tui: sequence_guard.rs split - under 1,000 lines (#3083) 430d6141a0ccmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: session_engine/request_timing.rs split - under 1,000 lines (#3084) fdd1f5bbfbcamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the session_ui composition root trims under 1,000 lines (#3064) b068d7a48a13merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: chat.rs split - under 1,000 lines (#3081) 65525952ae25merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: daemon_client.rs split - under 1,000 lines (#3086) ddef55111f26merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * make: the actionlint target lints every live workflow file - add .github/workflows/windows-runtime-triage.yml to the invocation (the #3022 on-demand windows triage workflow arrived with the fold; it pre-verifies LINT-CLEAN under actionlint 1.7.12, so 'lints every workflow' is true again) (macroscope d2cf164e) * pa-daemon: supervisor_e2e.rs splits by test family - under 1,000 lines (#3067) 81b928e55a00merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: view.rs split - the 3,888-line god-file ends as an 841-line composition root + 5 concern children (#3088) 0ff470e08385merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the agent_engine test mass splits by family - under 1,000 lines (#3059) 9cabd79136demerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * runtime: blocking usage beyond the auto-bg threshold degrades to a handle - bash awaits and python execution alike (#3076) b17703d1425cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: chrome.rs split - under 1,000 lines (#3087) 7af1b5840f32merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/ci: the TS-parity sweep-2 quick-fixes - Gemma 4 thinkingLevel on Vertex (TS #2946), Azure store:false (TS #2948), the staleness gate live (TS #2567) (#3068) b5cf6ec2b29cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: tree_list.rs split - under 1,000 lines (#3091) d54b591b12a2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: autocomplete.rs split - under 1,000 lines (#3092) 6a90ccf77948merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: keybindings.rs split - under 1,000 lines (#3090) 337d2efcc712merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: mcp_view.rs split - under 1,000 lines (#3094) 500fcd9581a9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the fold-5 tip restructured the venv probe surface and its windows-cross gate pair went inconsistent - the venv.rs test import list carried clear_in_process_probe_memo_for_tests and installed_package_dir at cfg(test) while their defs/callers sit at cfg(all(test, unix)) - E0432 + unused-import on the windows cross target (tip debt the promoted job surfaces: the tip's own ci.yml never runs it); split both names to the matching all(test, unix) gate (the #2833 pattern, zero behavior change). Pre-verified on-box: cargo check+clippy --locked --workspace --target x86_64-pc-windows-gnu --all-targets -D warnings BOTH GREEN * pa-daemon: worker/turn_stream_tests.rs split - under 1,000 lines (#3095) 2b9778a0dc6emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-core is pedantic-clean (#3093) 273b29234448merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the goal timer counts from the goal creation; the goal continuation fires once per boundary (#3048) f116a6b5a849merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the termios + process-tree exit audit - no raw-mode/flow/orphan/fd leaks (#3089) 13683dba140dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine/turn.rs split - under 1,000 lines (#3102) c8af2dd96ba0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the per-model layer trims to the minimal format reference - the empty block gone (#3106) bd3b03f57b6bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: scheduled_jobs.rs split - under 1,000 lines (#3105) 67ea4b6ff782merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-core: the image-heavy session-open fix - the render-path skip + the measured fast paths (#3098) 3325e22b396emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: settings_menu.rs split - under 1,000 lines (#3108) b789ea8dc265merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: the small crates are pedantic-clean (pa-ai, pa-agent, pa-types, pa-telemetry, pa-models) (#3110) 25ab57d2829fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the hover + click affordances - the dock groups, the hints, the agents-view rows, the dropdowns; every clickable thing shows it (#3109) 0f871da2e8a1merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install/pa-daemon: the takeover completes - the rust daemon stops on update; the schema-family match; the no-auto-resume contract (#3107) 29645e1b9bb7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor_restart_e2e.rs splits by test family - under 1,000 lines (#3114) 9434853a18e7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-telemetry: the #2117 tracking intent lands clean - the modular catalog, the accurate firing, the edge cases pinned (#3100) 942f003642b0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai: stream_failure.rs split - under 1,000 lines (#3116) 4b7300a6147dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: engine.rs split - under 1,000 lines (#3118) 8b6dda11865dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the handshake channel stays private until the auth answer installs it - the launch-storm connect-budget wedge closes (#3075) 80e9fe60091emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: harness_digest.rs split - under 1,000 lines (#3119) c806bee6fe79merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-daemon: the bare /skill: invocation guards - the TUI hint + the empty-args notice + the engine floor (#3113) 2d72de5cef32merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: agent_messaging.rs split - under 1,000 lines (#3120) 691e0785cca3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): the cross-view layout handoff - reuse the visible-window packs on the agents->chat re-entry (-100.1ms / -35.7% at canon) (#3103) cd55ae21aefemerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: session_stats.rs split - under 1,000 lines (#3122) af8138eaee3amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: models/registry.rs split - under 1,000 lines (#3124) 4c4d622bcb8dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: compaction_arms.rs split - under 1,000 lines (#3125) 16d6c239ae3amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-ai): append streamed Responses mirror text and reasoning-details fragments in place instead of re-copying per delta (#3035) * perf(pa-core): scan only new bytes for newlines - linear line framing (TS #2781 twin) (#3042) * test(pa-core): the multi-MiB protocol-line timing tests for the kernel reader and the extension LineDecoder (TS #2781 twin) A 4 MiB decoder line fed in 1 KiB chunks and a 31 MiB blank kernel line read through the 64 KiB pipe reader must complete under the computed bounds: while every chunk rescans the buffered prefix, they scan >= 8.6 GB and >= 8 GB and overrun them. The blank line never reaches parse_event, so the bound separates pure scanning from the quadratic rescan. Failing runs report their real duration in the assertion message. * perf(pa-core): the kernel protocol reader and the extension LineDecoder scan each byte once - linear line framing (TS #2781 twin) Both readers keep only the newline-free tail of earlier chunks, so the newline scan resumes at the old buffer length instead of restarting at zero: while one line accumulates, every chunk rescanned bytes already known to hold no newline. The decoder also consumes lines by offset and drains once per feed instead of one O(remaining) drain per line. Measured (8-core sandbox, prebuilt debug test binaries, medians of 3): a 4 MiB decoder line in 1 KiB feeds 14.27s -> 0.014s (~1000x); a 31 MiB blank kernel line 13.85s -> 0.65s (the ~13.2s quadratic rescan eliminated; the remainder is the one-pass scan plus the UTF-8 and trim checks the blank line still pays). Frame handling is byte-identical: same oversize checks and order, CR and blank-line rules, invalid-UTF-8 endings, and post-error buffers. * perf(pa-daemon): mint session entry ids against the by_id index instead of rebuilding an id map per append (#3053) append_entry and persist_entry_at rebuilt a HashMap of every entry id on each call just to check the new id for collisions. The store's by_id index already holds the same ids, so check against it: appends drop from O(n) to O(1). The fork and branch paths in session_tree reuse by_id the same way instead of keeping their own id copies. * perf(pa-ai): Anthropic stream edits the output blocks directly instead of copying a second block list per delta (#3056) * pa-ai(anthropic): mutate output.content directly instead of copying a duplicate block list per delta * pa-ai(anthropic): trim the stream snapshot test per review (struct-update expected values, one-line terminal assert) * pa-ai(anthropic): state why the stream snapshot test allows too_many_lines * pa-cli/pa-daemon: daemon-attached ACP honors the CLI session flags (#3096) The daemon-attached ACP path dropped --append-system-prompt, --system-prompt, --skill, --prompt-template, --extension, --tools, --thinking and --autonomous*. The CLI now sends them in the daemon create config under the TS field names, the supervisor keeps them in the stored create command, and the worker feeds them into every session build (autonomous starts enabled with its limits). * pa-tui: the @ fuzzy file search - fd's ignore-crate walk off the UI thread (#3097) `@` tokens route to a background walk with fd's semantics (the ignore crate: --type f/d, --follow, --hidden, --exclude .git, the 100-result cap, smart-case regex on the name - the whole path for slash queries, the scoped @dir/ form, quoted values); TS scoreEntry sorts and truncates the menu, and the apply adds the TS @ branch's trailing space for files. The editor parks the request at its idle tick, drops a stale search on the next one (cancelling the walk), and a new request aborts the in-flight one. * perf(pa-daemon): the resume create folds the saved context once - the model restore's second windowed open and its duplicate fold are gone (-62ms / -98% of the create-path restore class at the 22.9MB image-heavy fixture) (#3127) f5384e379cbamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(tui): the attached idle wake cut - the reader parks edge-driven, the quiet tick arms only on pending work (#3126) 73dae6dd89d8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-daemon): saved sessions keep their parent link, and the family view checks depth so forks are not children (#3041) * pa-daemon: saved rows publish the header binding and the family classifiers apply its depth (TS summaryForInactiveSession + selectAgentFamily) `saved_session_summary` now publishes `rlmDepth` always and `parentSessionPath` only when one is recorded, restoring the TS `summaryForInactiveSession` row: a session a user created under a parent (feature 1's top-level file binding) keeps its family edge in `agent_observe`/`agent_message` once its worker is gone, exactly like a resident one. Publishing the binding alone would regress: a fork carries its source's `parentSessionPath` at its source's own depth, and the depth-less file arms of `row_is_child`/`row_is_sibling` would read it as a child (live forks already are; saved ones would become one). The file arms now apply TS `selectAgentFamily`'s depth rule - a child sits exactly one level down, a sibling at the same depth - read from `FamilyIdentity::rlm_depth` (from the session summary) and the row's `rlmDepth` (TS `agent.rlmDepth ?? 0`). The spawn-id arms stay depth-free: only spawned children carry them, and a spawn always sits one level below its parent. Operator context: the "agents and users are equal collaborators" ruling (snimu 2026-09-28), same precedent as the chrome.rs 2026-09-24 directive notes - daemon-side internals only, no new public surface, no pa-types change. * pa-daemon: a depth-0 binding is no parent edge - the family reads route through one parent_binding accessor (TS familyCatalogEntry) Review fix for 3e14b7e51: the depth rule alone broke the common `/fork` case. A fork of a root carries its source's `parentSessionPath` at depth 0, and TS never treats a depth-0 binding as a parent edge (`familyCatalogEntry` keeps `parentSessionPath` only when `depth > 0`) - a root fork is a plain root and a Sibling of its source. The first commit's classifiers instead read the raw field everywhere, so a saved root fork vanished from its source's family and a live one went from Child to absent. One accessor now states the rule once and every family read of `parentSessionPath` routes through it: `from_summary` (a root fork's identity is top-level, its source is a Sibling, never its Parent), `row_is_child`'s file arm, `row_is_sibling`'s top-level arm (a root fork row is a root too) and its file arm. The wire keeps the raw field (TS also publishes it in `summaryForInactiveSession` and strips it only when building the family catalog), so saved rows and peers are untouched; the `parentSessionId` half of the TS guard is not needed (spawn ids only exist on subagent summaries, always depth >= 1). Tests: the family test is renamed and now expects the root fork as Sibling; a new part (iii) builds the fork's identity through `from_summary` - without read 1 it labels its source Parent and drops the other roots. The two moved-parent fixtures gain the `rlmDepth: 1` every real worker summary publishes (the identity is a depth-1 child). The whole-tuple asserts and the `row_depth` reuse in `from_summary` fold in the review nits. * feat(pa-tui): the activity dock renders in every session, all-zero included (#3036) The bottom activity dock was mounted only while some count existed (subagent history, heartbeats, bash history, or a live goal), so an idle session rendered nothing below the tray. The operator's 2026-09-28 directive: the dock renders in every session — the muted rule plus ` ◆ 0 subagents · ◷ 0 heartbeats · ▸ 0 shells` — and its Subagents group opens the scoped agents view even with no children, which shows the view's existing `No sessions yet.` empty state (TS `SubagentSummaryLine` renders nothing at zero; sanctioned divergence, the same precedent as the chrome.rs operator-directive notes). - delete the visibility premise: `ActivityDock::visible()` and the `subagents_total`/`bash_total` fields (their only consumer was the gate); `render_activity_dock` returns `Vec` and drops the `width == 0` early return (the truncator already yields an empty row at width 0 — keeping the guard would be an impossible-state defense) - `update_subagent_summary` always mounts the dock; a focused selection only steps when its group leaves the row (only the goal group can) - `focus_activity_dock` (alt+a and every dock panel's close) always takes focus; the duplicate step-into-groups copy is gone (`update_subagent_summary` owns that step) - the scope-back dock-focus restore is assigned directly after the attach (the attach's rebind reset clears focus): the `pending_dock_focus_restore` one-shot deferral existed only so the restore could check `visible()` once the roster had seeded - the PromptDown gate stays (TS `isSelectable()` parity — the prompt's Down keeps input-history recall in zero sessions), and `DockFold` keeps its machinery with counts-rationale comments Tests: the all-zero headless e2e (the dock row renders, alt+a + Enter opens the scoped empty view, which carries the exact AgentsViewScope) fails without the change; the childless-scope unit test pins the newly reachable empty view's keys (search, Enter no-op, escape back, ctrl+d, ctrl+n dispatch); the pinned mouse-selection geometry moves two rows up (25:66 -> 23:66) because the dock always renders. Visible behavior note (the operator's 2026-09-26 panel-exit ruling now applies in zero sessions): closing the heartbeats view, the bash view, or the goal panel restores focus to the panel's own dock item instead of the editor; typing still releases the focus into the editor path. * revert: the auto-backgrounding guards (PR #3076) - not yet (#3129) 7ebcf2c7f409merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-tui is pedantic-clean (#3134) b4ff5a053977merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-agent/pa-daemon): stop copying the whole streamed message on every delta (#3045) * perf(pa-agent/pa-daemon): share streaming partials via Arc and convert to wire form at coalescer flush * pa-daemon/pa-agent: review fixes for the streaming-snapshot change * perf(pa-tui): cache settled markdown blocks like TS and reuse the cache for row counts (#3060) * pa-tui: cache settled markdown blocks like TS and reuse the cache for row counts * pa-tui: tighten the markdown cache comments * pa-tui: accent every recognized slash command in the editor (#3080) * chore: remove the ci/ workflow staging dir - the promotion-era holdover (the live set is .github/workflows/) (#3133) 6a6d22e35984merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: a mouse click expands only the clicked card (#3043) * fix(pa-tui): a mouse click expands only the clicked card * fix(pa-tui): the layout handoff skips clicked cards - the re-entry renders them at the level A clicked card's layout slot holds its flipped rows, but the toggles live in the exiting view and the re-entered chat starts with none. The agents-view round trip served those rows anyway: the card rendered expanded while its row count said collapsed, and the next click looked like it did nothing. stash_layout_handoff now skips the entries in toggled_cards, so they re-render at the conversation level on re-entry, like TS mounting fresh components. * feat(pa-daemon): the whole-worker idle passivation - TS idleEvictionMinutes gains its consumer (the settled-child whole-worker stop, the passive-row survival, the wake-and-revive) (#3104) 7e42d9718928merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-ai): the windows-latest pair - the callback port-bind + the bedrock h2/http1 answer (#3137) 43a9f20004ebmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-ai): the review pass on the windows pair - the readiness event replaces the fixed sleep (#3141) 82abcc6e48e9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli: the kitty probe's verdict-time contract locked as e2e oracles (the DA1 early conclusion timed + the deadline's late-kitty role documented) (#3138) 760f2e275134merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790709491_1423357 GREEN. * pa-tui: the tip's kitty-probe wave put the unix-only vendored support check on the cross surface - spawn_kitty_probe calls crossterm::terminal::supports_keyboard_enhancement_checked_raw (cfg(all(unix, feature = events)) in the vendor), so E0425 on both windows targets; gate the probe + its answer channel import + KITTY_QUERY_FALLBACK + enable_kitty + the late-answer test to unix, with a non-unix stub that settles probed-but-unsupported (the no-answer probe path's settle) (the #2833 pattern, zero unix behavior change; tip debt the promoted job surfaces - the tip's ci.yml never runs windows-cross). Pre-verified on-box: workspace cross clippy -D warnings GREEN, pa-tui unix clippy GREEN, fmt clean * pa-cli: kitty_exit_routes_e2e.rs split - under 1,000 lines (#3135) ef9fe60e80ccmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/pa-core/pa-daemon: the provider failure never settles silently; the goal continuation checks progress - the 402 diagnosis fixes (#3101) c32b074fc57emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: engine.rs split - under 1,000 lines (#3111) 14651aab0c60merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the update funnel fetches the official domain (the merge-window flip) (#3142) 6594ec52eba0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: the promoted windows-latest surfaces two tip-side path-shape tests ungated - parse_consumes_socket_json_and_separator (unix socket paths; windows transport is named pipes) and fork_startup_selection_expands_a_tilde_selector (unix HOME tilde expansion) both fail on the windows target; gate each test to unix (the #2833 pattern, zero behavior change; tip test debt the promoted job surfaces - the tip's own ci.yml never runs windows-latest). Pre-verified on-box: workspace cross clippy -D warnings GREEN, pa-cli unix clippy GREEN, fmt clean. NOTE: the #3137 pa-ai pair GREENED on the 78338081c wave (both tests ok; pa-ai binary 298 passed / 0 failed) * ci: the release flow core - the release PR, the GitHub-only tags, the nightly cron, the publish wiring, the 0.10.0 lineage (#3069) b64e7feb6cafmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * Show the same session cost in the chat title and the agents view (#3112) 99da012fca54merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: turn_boundary.rs split - under 1,000 lines (#3147) 80a5d54964c5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * Make 9 declared keybindings work: external editor, model selector, agents view (#3117) 7d889e0d06f5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: enforce clippy::pedantic - the gate the five campaigns earned (#3152) e8ef65947f8bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: manager_catalog.rs split - under 1,000 lines (#3153) 1d2ba12130d0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: the wave speedup - the cargo cache + the shard-count knob (#3151) c1e9b848abeamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-tui): the selection color matches the hover band - the pink/purple replacement in the agents view + the tab below the prompt bar (#3161) 300ba148eca1merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-tui): the Esc recursion overflow - the pop loop terminates at the empty state (#3160) b128daf8c909merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the ACP config fixture redirect resolves on windows - the registry fallback order (#3162) 462c9fa8934dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-telemetry+pa-types: the fold-8 tip wave put two more cross-only clippy sites on the promoted windows surface - set_private's non-unix arm is legitimately await-free (cfg_attr allow(clippy::unused_async); the fn stays async for the shared call site) + the identity.rs non-unix socket_identity stub gains #[must_use] (the tip debt class: the tip's own ci.yml never runs the windows jobs; zero unix behavior change) * pa-types+pa-telemetry: the trunk CI's promoted cross job surfaces the windows arms' accumulated clippy debt (the dark-tip class, 14 sites) - process_start_id/process_executable_path/ensure_cooked_tty gain #[must_use]; the FileTime ticks use u64::from; the FFI calls pass std::ptr::from_mut instead of the implicit borrows (query_full_process_image_name, GetProcessTimes, GetExitCodeProcess); the fixed-array length cast carries its allow-with-reason; the BlockingPipeClient Debug impl goes finish_non_exhaustive; the file-sink set_private allow gains clippy::unused_async_trait_impl (the trait-impl variant of the same lint the first fix allowed - the cross check fires BOTH names). Zero behavior change everywhere; verified against the workspace cross clippy mirror in the lane sandbox * pa-core+pa-daemon: the promoted cross jobs' third layer - the windows arms' remaining clippy debt (16 pa-core sites + 5 pa-daemon warning-level sites the MSVC clippy fires) - must_use on the file_mode/is_executable/is_readable_writable/kill_pid/kill_process_group_or_pid/open_pidfd/pidfd_signal/pid_exists/termination_signal/socket_dir/default_daemon_socket_path/worker_socket_path stubs; i64::from the three mtime_nsec casts; from_ref/from_mut the SetFileTime/GetProcessTimes-family borrows; the POSIX tv_sec/tv_nsec spellings carry their similar_names allow; the always-Ok make_executable and the pipe prepare_socket_path carry unnecessary_wraps/unused_async allows-with-reason (shared signatures); the pipe arm's same_file_identity carries unused_self. Zero behavior change; verified against the in-VM cross clippy mirror * pa-core: the third layer's SetFileTime from_ref call takes its fmt-canonical wrap (the gate caught the one-liner; the tree re-synced to the pushed head before this fix landed as its own commit - no amend-after-push, no force) * REPAIR: fold-9's AA resolution reverted the trunk's aab7135c5..e75f59efc wave in 32 files - the byte-for-byte check compared main's side against the WRONG base (fold-8's aab7135c5 instead of fold-9's e75f59efc), so --ours kept the stale copies. Restored the trunk's content in all 32 (continuous.yml, release.yml, install-rust.sh, Cargo.* manifests, pa-daemon/supervisor.rs [the fd-limit raise], pa-core update/installer.rs [the release-channel machinery], the pa-tui surface, pa-types/ai, fd_lifecycle_e2e, extensions/framing) - the ONLY surviving lane deltas are the intentional ones: the workflow unification set, pa-types/platform/process.rs (my cross fixes), and the mechanical windows set. This answers the 18 re-review threads flagging the reverted content (fd limit, installer, R2, custom_message, release.yml) * pa-core: the set_last_write_time similar_names allow gains its reason comment (the cursor thread is right - unix_to_filetime's allow states the POSIX tv_sec/tv_nsec vocabulary, this one did not) * pa-core: the trunk's restored process.rs carries the same cross-lint debt my old copy did - the 7 sites (raise_open_file_limit not-unix, kill_pid/kill_process_group_or_pid windows, open_pidfd/pidfd_signal not-unix, pid_exists windows, termination_signal not-unix) gain #[must_use] on the trunk's own layout (the same fix class; zero behavior change) * pa-core: the not-unix raise_open_file_limit gains its # Errors section (missing_errors_doc on windows-cross) and drops the double must_use (Result is already must_use - my blanket must_use x7 over-marked this one site; the other six return bool/Option and stand) * ci: restore contribution-gate.yml (lost in fold 8's add/delete conflict - the rust port side deleted the TS-era file while this PR's adapted version was the other side; the merge took the deletion, orphaning the ci.yml comment 'the auto-close enforcement lives in contribution-gate.yml' and breaking make actionlint's file list). The gate is the pull_request_target arm the ci.yml:102 thread asks for: the BASE-branch file an author cannot strip. Plus the union's new nightly.yml lint: the SC2015 note on the loop-guard gains its disable-with-reason (the continue IS the intended else) * ci: the windows-latest job's timeout 90->120 - the wave's build+clippy finished green but the full MSVC test battery hit the 90-minute cap (cancelled mid-battery); windows-runtime-triage.yml times the same battery on the same runner at 120 (the repo's own calibration for the battery's duration) * ci: the windows-latest job drops from this promotion set (the conductor's ruling (b), 2026-09-30 12:45Z) - the full MSVC battery surfaced tip-side windows product debt the trunk carries invisibly (the on-demand triage battery never ran on main; its first dispatches read deep red across crates; the ACP daemon-attach e2e deadlocks on the named-pipe transport), and shipping the unification with its own promoted job red is self-defeating. The promotion lands with the windows-readiness lane's product fixes. windows-cross stays this PR's windows authority (compile + clippy for the whole workspace incl. cfg(windows) impls - GREEN on the exact head); the comment records the split * ci: empty-commit retrigger of the 36718118562 wave - shard 1/8 (login_panel_pty_e2e model_picker_routes_the_sign_in_flow, panicked at :716) + shard 3/8 (fd_lifecycle_e2e worker_fd_count_stable_across_prompts, :455) are the battery-parallel flake class: the identical unix tree ran the same 8/8 shards green on both prior waves (36689982734 @ d5e7a812d, 36702439162 @ 8c729f1a0), and both tests pass solo on this exact head in the lane sandbox (isolation: 0.22s / 2.59s); the fd-count class is the registry's red-supervisor-restart-loop-eagain-battery-load family (the same file's load flake), the PTY e2e the load-correlated e2e family. NOT tree-caused; no rerun --failed (banned); the compliant re-roll * Cargo.lock: yoke-derive 0.8.3 -> 0.8.4 - 0.8.3 was yanked upstream today and the promoted deny job's advisories check correctly gates on it (the operator's accepted trade: the advisory DB drifts daily). The 2-line bump verified clippy-clean in the lane sandbox VM (the whole workspace builds + clippy green on the bumped lock). The trunk's own deny (continuous.yml, every push) will need the same bump * pa-core: the fold-10 trunk wave's #3168 request-payload capture carries its own cross-target lint debt (the promoted windows-cross job surfaces it; the tip's own ci.yml never runs cross) - the unix-only writer machinery (CaptureJob, drain_writer, capture_envelope, write_capture, refuse_symlinked_components, prune) gains cfg_attr(not(unix), allow(dead_code)) with the confidentiality-design reason (the capture is DISABLED on non-Unix by the module's own design: the platform wall's Windows arms are inherited-ACL no-ops, so the machinery compiles dead there by design, not by accident); the disable-block's tail return drops to the block value (needless_return); the test-only at() tightens to all(test, unix) matching its unix-gated callers; payload_calling_provider gates cfg(unix) matching its callers. Zero behavior change; verified against the in-VM cross clippy mirror * ci: empty-commit retrigger of the 36750174989 wave - shard 5/8's tool_results::tool_result_entries_persisted_and_streamed is the registry's rotating-flake family (registry: 'rotating flake (pa-daemon supervisor_e2e.rs:1880)', conductor-classified); isolation-green 0.82s on this exact head in the lane sandbox; the identical pa-daemon content ran the same 8/8 shards green on the prior waves (36729899016, 36742282004). NOT tree-caused; no rerun --failed (banned); the compliant re-roll * ci: the trust gate's allowed output covers merge_group (both bots' finding - the composed model's gap: the trunk's new merge_group trigger meant the queued merge candidate skipped the vouch step [its if is pull_request-only] and allowed=false skipped EVERY gate - changes, fmt, clippy, the shards, windows-cross, deny - so the merge queue never validated candidates. The queue only takes PRs that already passed the vouch-gated pull_request wave, so merge_group auto-allows like push: the merge-group run is the full-selection validation of the already-vouched candidate [the trunk's own comment says exactly this]) * ci: empty-commit retrigger of the 36784552539 wave - shard 3/8 (fd_lifecycle_e2e supervisor_restart_loop_leaves_no_orphan_workers, panicked at :182) is the registry's supervisor-restart battery-load family (red-supervisor-restart-loop-eagain-battery-load-20260930-1: the same file's restart-loop timeout class); isolation-green 14.81s solo on this exact head in the lane sandbox; the identical content ran the same 8/8 shards green on the four prior fold waves (36770076344, 36773914061, 36777339539, 36780662405). NOT tree-caused; no rerun --failed (banned); the compliant re-roll * ci: empty-commit retrigger of the 36805541056 wave - shard 3/8 (fd_lifecycle_e2e worker_fd_count_stable_across_prompts, :455) is the same battery-parallel flake this test showed in the earlier cycle (isolation-green then AND now 1.85s on this exact head in the lane sandbox; the identical content green on every intervening fold wave incl. 36803479472); the fd_lifecycle battery-load family is registry-cited (red-supervisor-restart-loop-eagain-battery-load-20260930-1). NOT tree-caused; no rerun --failed (banned); the compliant re-roll * ci: empty-commit retrigger of the 36807199626 wave - shard 4/8 (wave_b10_heartbeat_snapshot_fallback, protocol_breadth_b10_b11.rs:769) is the REGISTRY-CITED flake (red-wave-b10-heartbeat-snapshot-fallback-20260929-1: 'flaky (freeze/stale propagation race): pa-daemon wave_b10 heartbeat snapshot'); isolation-green 5.71s solo on this exact head in the lane sandbox; the identical content green on every prior fold wave. NOT tree-caused; no rerun --failed (banned); the compliant re-roll * ci: seed .github/VOUCHED.td (the maintainer's BLOCKER finding: the file was MISSING entirely - not just empty - and with the vouch gate live every external PR/issue would auto-close. Restored the exact historical format + entry from the #1899 vouching commit a903d4b67 [the file the TS era carried until the Rust port dropped it]: sirouk) * ci+pa-daemon: the maintainer review's fixes (snimu, 2026-10-01, all four validated findings): (1) BLOCKER: .github/VOUCHED.td was MISSING entirely (not just empty) - with the vouch gate live every external PR/issue would auto-close. Seeded in its own commit (0c899ed1) with the exact historical format + entry from the #1899 vouching commit a903d4b67: sirouk. (2) The trust-step-error silent skip: a vouch-step error (the action's setup, the runner) left every dependent job SKIPPED and skipped required checks read as passing to branch protection - a green-looking wave with no gates run. THE FIX: every dependent job now gates on needs.trust.result == 'success' too, and both gated workflows gain an always() trust-audit aggregate job that runs unconditionally and FAILS RED when the trust gate did not conclude cleanly - the required-check set can no longer look green on a trust error. The deliberate not-vouched path is untouched: there the trust job SUCCEEDS with allowed=false, the dependents skip by design, and the contribution-gate auto-close enforces. (The setup-nu step inside the pinned vouch action is already sha-pinned - hustcer/setup-nu@920172d9 - so the action-side pin the review asked about is present; the nu *version* float lives inside that pinned third-party action.) codebase-health.yml also gains the merge_group auto-allow it was missing (the same gap class the bots caught in ci.yml earlier). (3) The windows-cross job's dtolnay/rust-toolchain 'toolchain:' input is ignored by the action (the ref IS the toolchain) - dropped, with the pin comment corrected. (4) pa-daemon session_store/info.rs: the same_file_identity comment claimed the not-unix arm is 'the length-only check' - it answers false (the grown-or-equal length check lives at the call sites). The comment now states both accurately. * pa-tui: the missed third enhanced_keys.rs conflict region (the #3196 windows-shipped doc on the not-unix spawn_kitty_probe) resolved THEIRS - my marker-grep was truncated (head -6) and the region at :695 went unseens; the gate's clippy caught the diff marker. A full-tree marker scan now clean * pa-daemon+pa-core: the trunk's #3261 herdr connector + the #3257 kernel-startup test carry cross-target compile breaks (the promoted windows-cross job surfaces them; the tip's own ci.yml runs the cross job only on my composed tree): the herdr tests mod gates all(test, unix) [the fake server binds a unix socket; the fence cases use unix symlink identity], SOCKET_REFUSAL_LOGGED gates cfg(unix) [read only by the unix fence path], the windows pane_socket_acceptable gains the unused_async allow-with-reason [the shared call site stays async - the unix arm awaits], and the kernel_startup_join test file gates cfg(unix) [the provisioner stamps unix mode bits]. Zero behavior change; verified against the in-VM cross clippy mirror * pa-daemon: the herdr AtomicBool import gates cfg(unix) - it feeds only the unix-gated SOCKET_REFUSAL_LOGGED static (the follow-on to the cross fix; the cross clippy mirror catches the unused-import on the non-unix target) --------- Co-authored-by: perf-auth-lock-fast Co-authored-by: wc Co-authored-by: perf-slowdrain-exitguard-fast Co-authored-by: perf-rpc-models-persist Co-authored-by: perf-launch-open-fast Co-authored-by: Sebastian Müller